1 .section ".tbss", "awT", @nobits 2 .globl bg1, bg2, bg3, bg4, bg5, bg6, bg7, bg8 3 bg1: .space 4 4 bg2: .space 4 5 bg3: .space 4 6 bg4: .space 4 7 bg5: .space 4 8 bg6: .space 4 9 bg7: .space 4 10 bg8: .space 4 11 bl1: .space 4 12 bl2: .space 4 13 bl3: .space 4 14 bl4: .space 4 15 bl5: .space 4 16 bl6: .space 4 17 bl7: .space 4 18 bl8: .space 4 19 .text 20 .globl _start 21 .type _start,@function 22 _start: 23 pushq %rbp 24 movq %rsp, %rbp 25 26 /* IE against global var */ 27 movq %fs:0, %r11 28 nop;nop 29 addq sG6@gottpoff(%rip), %r11 30 nop;nop;nop;nop 31 32 /* IE -> LE against global var defined in exec */ 33 movq %fs:0, %rdx 34 nop;nop 35 addq bg6@gottpoff(%rip), %rdx 36 nop;nop;nop;nop 37 38 /* IE -> LE against local var */ 39 movq %fs:0, %r12 40 nop;nop 41 addq bl6@gottpoff(%rip), %r12 42 nop;nop;nop;nop 43 44 /* direct %fs access IE -> LE against local var */ 45 movq bl8@gottpoff(%rip), %rdx 46 nop;nop 47 movq %fs:(%rdx), %rax 48 nop;nop;nop;nop 49 50 /* IE -> LE against hidden but not local var */ 51 movq %fs:0, %rdx 52 nop;nop 53 addq sh6@gottpoff(%rip), %rdx 54 nop;nop;nop;nop 55 56 /* direct %fs access IE -> LE against hidden but not local var */ 57 movq sh8@gottpoff(%rip), %rdx 58 nop;nop 59 movq %fs:(%rdx), %rax 60 nop;nop;nop;nop 61 62 /* LE, global var defined in exec */ 63 movq %fs:0, %rax 64 nop;nop 65 leaq sg2@tpoff(%rax), %rdx 66 nop;nop;nop;nop 67 68 /* LE, local var, non-canonical sequence */ 69 movq $2+bl2@tpoff, %r9 70 nop;nop 71 movq %fs:0, %rdx 72 nop;nop 73 addq %r9, %rdx 74 nop;nop;nop;nop 75 76 /* LE, hidden var defined in exec, non-canonical sequence */ 77 movq %fs:0, %rdx 78 nop;nop 79 addq $sh2@tpoff+1, %rdx 80 nop;nop;nop;nop 81 82 /* Direct %fs access */ 83 84 /* LE, global var defined in exec */ 85 movq %fs:sg3@tpoff, %rax 86 nop;nop;nop;nop 87 88 /* LE, local var */ 89 movq %fs:bl3@tpoff+3, %r10 90 nop;nop;nop;nop 91 92 /* LE, hidden var defined in exec */ 93 movq %fs:1+sh3@tpoff, %rdx 94 nop;nop;nop;nop 95 96 /* LE, large model */ 97 movabsq $sh2@tpoff+1, %rdx 98 99 leave 100 ret 101
